import { prisma } from '@/lib/prisma';
import { comparePassword } from '@/lib/password';
import { signAccessToken, signRefreshToken, verifyRefreshToken } from '@/lib/jwt';
import { sanitizeEmail } from '@/lib/sanitize';

export async function loginService(email: string, password: string) {
  const cleanEmail = sanitizeEmail(email);
  if (!cleanEmail) throw new Error('EMAIL_INVALID');

  const user = await prisma.user.findUnique({
    where: { email: cleanEmail },
    select: {
      id: true,
      email: true,
      name: true,
      role: true,
      isActive: true,
      passwordHash: true,
    },
  });

  if (!user || !user.isActive) {
    // Tiempo constante para evitar timing attacks
    await comparePassword('dummy', '$2b$12$dummy.hash.to.prevent.timing.attacks.xx');
    throw new Error('INVALID_CREDENTIALS');
  }

  const passwordValid = await comparePassword(password, user.passwordHash);
  if (!passwordValid) throw new Error('INVALID_CREDENTIALS');

  const payload = { userId: user.id, email: user.email, role: user.role, name: user.name };
  const accessToken = await signAccessToken(payload);
  const refreshToken = await signRefreshToken(user.id);

  return {
    accessToken,
    refreshToken,
    user: {
      id: user.id,
      email: user.email,
      name: user.name,
      role: user.role,
    },
  };
}

export async function refreshTokenService(token: string) {
  const payload = await verifyRefreshToken(token);
  if (!payload) throw new Error('INVALID_REFRESH_TOKEN');

  const user = await prisma.user.findUnique({
    where: { id: payload.userId },
    select: { id: true, email: true, name: true, role: true, isActive: true },
  });

  if (!user || !user.isActive) throw new Error('USER_INACTIVE');

  const tokenPayload = { userId: user.id, email: user.email, role: user.role, name: user.name };
  const accessToken = await signAccessToken(tokenPayload);
  const newRefreshToken = await signRefreshToken(user.id);

  return { accessToken, refreshToken: newRefreshToken };
}